What Is DMARC Policy? None, Quarantine And Reject

As email continues to be a critical communication channel for businesses and individuals alike, the importance of protocols like DMARC will only grow. DMARC, in full means Domain-based Message Authentication, Reporting, and Conformance and it represents a significant leap forward in email security.

DMARC provides a framework for email domain owners to publish policies on how their emails should be authenticated, helping create a more trustworthy email ecosystem. Implementing DMARC means organizations can proactively protect their brand, their employees, and their customers from email-based threats.

And while it’s not a cure-all for all email-related security issues, DMARC is a crucial tool in the fight against phishing and email spoofing attacks. In this article, we explore DMARC policy, how to implement it, the challenges and benefits, and why you should opt for our hosted DMARC solution for policy implementation.

Why DMARC Matters

Emails can be easily forged, making it hard to tell the real deal from a dangerous fake. That’s where DMARC comes in. DMARC is like an email security checkpoint that verifies the sender’s identity before letting messages through.

A report by Forbes estimates that the cost associated with cybercrime is projected to reach $10.5 trillion annually by 2025. Meanwhile, Verizon reports that more than 30% of all data compromises are a result of phishing attacks, highlighting the need for powerful protection like DMARC.

According to RFC 7489 of the IETF, DMARC has the unique ability to allow email senders to set preferences for authentication. By enabling it, you can also get reports on email handling and potential domain abuse. This makes DMARC really stand out in terms of domain validation.

To start the setup process for DMARC, you need to make a few DNS changes and include DNS TXT records for the protocols. However, manual implementation of the DMARC protocol can be quite complex for non-technical users. It may even get quite costly if you hire an external fractional CISO to manage it for your business. PowerDMARC’s DMARC analyzer is therefore an easy alternative. With our DMARC analyzer, we automate your DMARC policy setup, saving you both time and money.

“I found PowerDMARC after theGoogle and Yahoo new email sender requirements were issued. PowerDMARC hooked us up with a monitoring DMARC policy in no time! It helped us slowly (but surely) shift to an enforced policy for better protection.”, reported business owner Rachel R.

What is a DMARC Policy?

DMARC policy is an email validation system that uses Domain Name System (DNS) to instruct receiving mail servers on how to handle emails claiming to be from your own domain but failing authentication checks. It is denoted by the “p” tag in the DMARC record that specifies the action mail servers should take if an email fails DMARC validation.

A DMARC policy can help you determine how strictly you want to handle emails that might try to impersonate your brand. Consider it a security guard for your organizational domain. Depending on your ID, the guard determines whether he lets you into the building (in this case, your receiver’s inbox). He may prevent you from stepping in (reject), he may send you to a special place for further review (quarantine), or he may just let you in (none).

Your DMARC policy when at p=reject can help you prevent spoofing, phishing, and domain name abuse, acting like a “no-trespassing” sign for bad actors trying to impersonate your brand.

So, in a nutshell, the three DMARC policy types include:

• DMARC None: A “monitoring only” policy that serves no protection. It’s good for the beginning stages of your deployment journey. Emails are delivered but reports are generated for unauthenticated messages.
• DMARC Quarantine: Suspicious emails are flagged and placed in the recipient’s spam folder for review.
• DMARC Reject: The strictest optionit instructs receiving servers to completely reject unauthenticated emails.

Let’s look at these policies more extensively, and how and when to implement each one of them.

3 Types of DMARC Policies: p=reject, p=none, p=quarantine

You can set DMARC records to none, quarantine, or reject, but the one to use depends on the level of enforcement email domain owners want to establish. The main difference between these policy options is determined by the action taken by the receiving mail transfer agent when adhering to the specified policy defined by the mail sender in their DNS records.

1. DMARC None Policy

DMARC policy none (p=none) is a relaxed mode that triggers no action on the receiver’s side. This policy can be used to monitor email activity and is typically used during the initial DMARC implementation phase for monitoring and data collection.

It doesn’t provide any level of protection against cyberattacks and allows all messages to be delivered, regardless of authentication results. This option is specified in the DMARC record using the “p=none” tag.

Example: v=DMARC1; p=none; rua= mailto:(email address);

None Policy Implementation Use Cases

• The main aim of domain owners who select the “none” policy should be to gather information on sending sources and keep a tab on their communications and deliverability without any inclination towards strict authentication. This may be because they are not yet prepared to commit to enforcement, and are taking their time to analyze the current situation.
• Receiving email systems treat messages sent from domains configured with this policy as “no-action”, meaning that even if these messages fail DMARC, no action will be taken to discard or quarantine them. These messages will successfully reach your clients.
• DMARC reports are still generated when you have “p=none” set up. The recipient’s MTA sends aggregate reports to ‌the organizational domain owner, providing detailed email authentication status information for the messages that appear to originate from their domain.

2. DMARC Quarantine Policy

This option is specified in the DMARC record using the “p=quarantine” tag. p=quarantine provides some level of protection as the domain owner can prompt the receiver to roll back emails into the spam or quarantine folder to review later in case ‌DMARC fails.

This policy instructs the receiving mail server to treat messages that fail DMARC authentication with suspicion. It is often implemented as an intermediate step between “none” and “reject”.

Example: v=DMARC1; p=quarantine; rua=mailto:(email address);

Quarantine Policy Implementation Use Cases

• Rather than outright discarding unauthenticated emails, the “quarantine” policy offers the ability for domain owners to maintain security while also providing the option to review emails before accepting them, taking the “verify then trust” approach.
• Changing your DMARC policy to DMARC quarantine ensures that legitimate messages that fail DMARC authentication will not be lost before you closely inspect them.
• This approach can be considered intermediate in terms of enforcement and facilitates a smooth transition to p=reject, wherein domain owners can:
  a) Assess the impact of DMARC on your email messages
  b) Make informed decisions regarding whether or not they should discard the flagged emails.
• The quarantine policy also helps reduce inbox clutter, ensuring your inbox doesn’t get overloaded with messages in the spam folder.

3. DMARC Reject Policy

This option is specified in the DMARC record using “p=reject”. This is the strictest policy, telling receivers to reject unauthenticated messages.

DMARC reject provides maximum enforcement, ensuring messages that fail DMARC checks are not delivered at all. The policy is implemented when domain owners are confident in their email authentication setup.

Example: v=DMARC1; p=reject; rua= mailto:(email address);

Reject Policy Implementation Use Cases

• DMARC reject enhances your email security. It can prevent attackers from launching phishing attacks or direct domain spoofing. DMARC’s reject policy stops fraudulent emails by blocking out messages that appear suspicious.
• If you are confident enough not to quarantine suspicious messages, the “reject” policy is suitable for you.
• It is important to thoroughly test and plan before opting for DMARC reject.
• Make sure DMARC reporting is enabled for your domain when on DMARC reject.
• To DIY your enforcement journey, start at p=none and then slowly move to reject while monitoring your daily reports.

Other DMARC Policies

DMARC offers additional policy parameters to fine-tune implementation.

1. The percentage (pct=) parameter allows gradual policy rollout by specifying the portion of messages subject to DMARC.
   For example: pct=50 applies the policy to 50% of messages.
2. The subdomain policy (sp=) is a DMARC policy record that sets separate rules for subdomains. It is useful when subdomains require different handling.
   For example: v=DMARC1; p=reject; sp=quarantine; rua=mailto:[email protected]`

DMARC Reporting Options

Reporting options for DMARC include:

• Aggregate reports (rua=) for high-level data on authentication results and sending sources.
• Forensic reports (ruf=) for detailed authentication failure information.

These parameters enable organizations to gather valuable insights on DMARC authentication results, giving insight into the number of emails that fail or pass DMARC authentication. A DMARC report also helps:

1. Identify potential issues and patterns of abuse
2. Detect misconfigurations in their email setup
3. Gain insights into email behavior and mail flows
4. Review authentication results for SPF and DKIM protocols

A Phased Approach to DMARC Policy Implementation

Implementing Domain-based Message Authentication, Reporting, and Conformance policies in a real-world scenario typically follows a phased approach. This method allows organizations to gradually tighten their email security while minimizing the risk of disrupting legitimate email flow.

You can follow this guide as a DIY DMARC policy enforcement. However, ideally, we recommend that you opt for our hosted DMARC solution to get expert assistance. Our professionals guide your DMARC implementation and throughout your enforcement journey.

Here is an optimized schedule:

Observation and Data Collection

This lasts about 2-4 weeks but can be longer for complex organizations. During this phase, you want to:

• Implement p=none, as this policy doesn’t affect email delivery but starts collecting data. You should also set up DMARC record:
  v=DMARC1; p=none; rua=mailto:[email protected]
• Analyze DMARC reports: You should review aggregate (RUA) reports to understand email patterns. These reports also help you identify legitimate sources of email that aren’t properly authenticated.
• Correct authentication issues: Work on properly configuring SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) for all legitimate email sources. This might need you to coordinate with third-party senders who use your domain.

 Limited Quarantine

This lasts about 2-4 weeks, and you should:

• Implement limited quarantine policy: Start by updating your DMARC record:
  v=DMARC1; p=quarantine; pct=5; rua=mailto:[email protected]
  This DMARC example record applies a quarantine policy to only 5% of non-compliant emails.
• Monitor impact: Closely watch for any unintended consequences on legitimate email. Then continue analyzing DMARC reports for improvements and remaining issues.
•  Gradual increase: Incrementally increase the pct value (e.g., 5% → 25% → 50% → 75% → 100%). Adjust timing based on the volume of issues encountered.

 Full Quarantine

This lasts about 2-4 weeks. You should:

• Implement full quarantine policy. To do this, update DMARC record to
  v=DMARC1; p=quarantine; rua=mailto:[email protected]
  This applies a quarantine policy to 100% of non-compliant emails.
• Final adjustments: Address any remaining authentication issues, and ensure all legitimate email sources are properly configured.

 Reject Policy

This is an on-going phase, and should only be implemented when domain owners are confident in their email authentication setup. You should:

• Implement reject policy. To do this, update your DMARC record to
  v=DMARC1; p=reject; rua=mailto:[email protected]
  Non-compliant emails will now be rejected by the receiving mail server.
• Continuous monitoring: Regularly review DMARC reports to catch any new issues and stay alert for changes in email patterns or new legitimate senders.

 Additional Considerations

If you’re implementing DMARC Authentication policies on your own, here are a few things to keep in mind:

• Subdomain Policy: Consider implementing a separate policy for subdomains only if needed.
  Example: v=DMARC1; p=reject; sp=quarantine; rua=mailto:[email protected]
• Forensic Reporting: Consider adding RUF (forensic) reporting for detailed failure information.
  Example: v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]
• Stakeholder Communication: Keep all relevant parties (IT, marketing, business units) informed throughout the process.
• Third-Party Sender Management: Maintain an up-to-date inventory of authorized third-party senders and work closely with them to ensure compliance.
• Policy Adjustment: Be prepared to temporarily revert to a less strict policy if significant issues arise.

Remember, the timeline for each phase can vary significantly depending on the complexity of the organization’s email infrastructure and the volume of issues encountered during implementation.

Common Challenges in DMARC Implementation

While DMARC offers significant benefits for email security, organizations often face several challenges during implementation. This is the reason most people opt for our Hosted DMARC–a service that helps you configure,monitor, and update your DMARC solution easily on a cloud platform.

PowerDMARC’s Hosted DMARC allows you to be in complete control of your DMARC compliances, while not having to know the ins and outs of technical details. Here are some of the most common issues you might experience when manually implementing your DMARC policies and strategies to address them:

•  Identifying All Email Sources

Many organizations struggle to identify all legitimate sources of email using their domain. You should conduct a thorough audit of all email systems, including marketing tools, CRM systems, and third-party services. Use the initial DMARC record “p=none” policy to collect data on all IP addresses sending mail out of your organization and engage with all departments to ensure no email sources are overlooked.

• Aligning SPF and DKIM for All Sources

Ensuring proper SPF and DKIM authentication for all legitimate email sources can be complex, especially with third-party senders. To remedy this, you need to work closely with third-party vendors to implement proper authentication. You could also consider using email gateways or DKIM signing services to centralize authentication. Lastly, consider implementing a staged approach, focusing on high-volume senders first.

1. Managing High Email Volumes

Large organizations sending millions of emails may find it challenging to monitor and respond to DMARC feedback effectively. Consider investing in automated DMARC reporting tools to handle large volumes of data. You can also implement gradual policy changes using the “pct” tag to manage the transition or otherwise outsource DMARC monitoring and analysis to specialized services.

2. Balancing Security and Deliverability

Strict DMARC check policies can sometimes impact the deliverability of legitimate emails. To handle this, consider a phased approach that gradually increases strictness. Also, closely monitor email deliverability metrics during policy changes and be prepared to quickly adjust policies if significant issues arise.

3. Coordinating Across Large Organizations

In large, complex organizations, coordinating DMARC implementation across different departments and regions can be difficult. You can solve this by establishing a cross-functional DMARC implementation team, and developing clear communication channels and processes for reporting issues. Additionally, create and distribute educational materials about DMARC across the organization.

4. Handling Forwarded Emails

Email forwarding can break DKIM signatures, fail SPF and cause DMARC failures. Therefore, educate your users about the impact of email forwarding on DMARC. Also, think about implementing Authenticated Received ChainARC) to preserve authentication through forwarding.

5. Managing Subdomains

Organizations may have different requirements for their main domain and subdomains. You can use the “sp” tag to set separate policies for subdomains. It is highly advisable try to maintain an inventory of all subdomains and their email usage.

6. Interpreting DMARC Reports

DMARC aggregate and forensic reports can be complex and overwhelming. Invest in DMARC reporting tools that provide clear visualizations and insights, train IT staff on interpreting DMARC reports, and consider partnering with DMARC experts for report analysis and recommendations.

7. Maintaining Ongoing Compliance

DMARC requires ongoing attention and maintenance as email systems and sending patterns evolve. Therefore, establish a regular schedule for reviewing DMARC reports and adjusting policies. In addition, implement change management processes for new email systems or senders and conduct periodic audits of your email authentication setup.

By anticipating these challenges and preparing strategies to address them, organizations can smooth their path to successful DMARC implementation and maintain robust email security.

Benefits of Enforcing Your DMARC Policy

Let’s delve into the advantages of setting up a strict DMARC policy for your domain:

1. Direct Protection Against Phishing and BEC

At DMARC reject (DMARC enforcement), any email that fails authentication is discarded. This prevents fraudulent emails from reaching your recipient’s inbox. It therefore offers direct protection against phishing attacks, spoofing, BEC, and CEO fraud.

This is especially important because:

• Verizon’s 2023 data breach investigation report found that 36% of all data breaches involve phishing
• Fortra’s 2023 BEC report concluded that cybercriminals love impersonating well-known brands

2. First Line of Defense Against Malicious Software

Ransomware and Malware are often spread via fake emails sent from external domains impersonating the sender’s domain. They can infiltrate and completely take over your operating system. A DMARC policy at reject ensures that unauthenticated emails are blocked out of your client’s inbox.

This automatically prevents your clients from clicking on harmful attachments. And further minimizes the chances of unknowingly downloading ransomware or malware into their system. Here, your DMARC policy acts as an elementary line of defense against these attacks.

3. Monitoring Your Email Channels

If you simply want to monitor your message transactions and sending sources, a DMARC record at p=none is enough. This will, however, not protect you against cyberattacks.

4. To Review Suspicious Emails Before Delivery

If you don’t want to block unauthorized emails outright, you can quarantine them. Simply leverage the quarantine DMARC policy to review suspicious messages before accepting them. This will lodge emails that fail a DMARC alignment check in your quarantine folder instead of your inbox.

Which is the Best DMARC Policy Type and Why?

DMARC reject is the best DMARC policy if you want to maximize your email security efforts and enable Gmail’s blue tick feature. This is because when on p=reject, domain owners actively block unauthorized messages from their clients’ inboxes.

Your DMARC policy provides a high degree of protection against cyberattacks. This includes direct-domain spoofing, phishing, and other forms of impersonation threats. Hence, it also doubles up as an effective anti-phishing policy.

At DMARC enforcement, you can also implement BIMI. BIMI lets you enable blue checkmarks for your emails in Gmail and Yahoo inboxes – which is quite cool!

Busting Common DMARC Policy Myths

There are some common misconceptions about DMARC policies. Some of these can have terrible consequences on your mail delivery. Let’s learn what they are and what the truth is behind them:

1. DMARC None Can Prevent Spoofing

DMARC none is a “no-action” policy and cannot protect your domain against cyberattacks. The p=none policy is frequently used as a security loophole by attackers to exploit domain names and emails.

Over the years, several domain owners have reached out to PowerDMARC, explaining how they are being spoofed even with DMARC implemented. On further review, our experts found out that most of them had their DMARC policy configured at “none”.

2. You Won’t Receive DMARC Reports at p=none

Even when on p=none you can continue to receive daily DMARC reports by simply specifying a valid email address for the sender.

3. DMARC “Quarantine” is Not Important

Often overlooked, the quarantine policy in DMARC is extremely useful for your transitional phases. Domain owners can deploy this to make a smooth transition from no-action to maximum enforcement.

4. DMARC Reject Impacts Deliverability

Even on DMARC reject, you can ensure your legitimate emails are delivered seamlessly. Monitoring and analyzing the activities of your senders can help. You must also review your authentication results to detect failures faster.

Troubleshoot DMARC Policy Errors

When using DMARC, you may encounter an error message. The following are some common DMARC policy errors:

• Syntax Errors: You should be wary of any syntax errors while setting up your record to make sure that your protocol functions correctly.
• Configuration Errors: Errors while configuring the DMARC policy are common and can be avoided by using a DMARC checker tool.
• DMARC sp Policy: If you configure a DMARC reject policy, but set up your subdomain policies to none, you will not be able to achieve compliance. This is due to a policy override on your outbound emails.
• “DMARC Policy Not Enabled” Error: If your domain reports highlight this error, it points to a missing DMARC domain policy in your DNS or one that is set to “none”. Edit your record to incorporate p=reject/quarantine and this should fix the problem.

Enforce DMARC Policy with PowerDMARC

PowerDMARC’s DMARC analyzer platform helps you effortlessly set up the DMARC protocol. Use our cloud-native interface to monitor and optimize your records with a few clicks of a button. Let’s explore its key benefits:

• PowerDMARC offers 7 views and filtering mechanisms for your DMARC Aggregate reports. Each view is designed to effectively monitor your email flows while in any DMARC policy mode.
• Aggregate reports are easy to read, human-friendly, and exportable
• Forensic reports can be encrypted to hide private information
• Our hosted DMARC feature allows you to update your DMARC policy modes easily. You can shift to p=reject and monitor your protocol effectively and in real time. You won’t need to enter your DNS management console for this.
• Our 24-hour active support team will help you transition smoothly from a relaxed to an enforced DMARC policy. This can maximize your security while ensuring deliverability.
• You can set up custom email alerts to detect any malicious activity and take action against threats sooner
• We support multi-tenancy and multiple language translations on the platform. This includes English, French, German, Japanese, Dutch, Italian, Spanish, Russian, Norwegian, Swedish, and Simplified Chinese

Contact us today to implement a DMARC policy and monitor your results easily!

DMARC Policy FAQs

Our Content and Fact-Checking Review Process

This piece of content was authored by a cybersecurity expert. It has been meticulously reviewed by our in-house security team to ensure technical accuracy and relevance. All facts have been verified against official IETF documentation. References to reports and statistics that support the information are also mentioned.

• About
• Latest Posts

Maitham Al Lawati

Cybersecurity Expert, CEO at PowerDMARC

Maitham is a tech entrepreneur, cybersecurity expert, CEO and Founder of PowerDMARC with 15+ years of industry experience. Maitham holds a Global MBA from the University of Manchester and various professional certifications including CISSP, CISM, CRISC, and ISC2 CCSP.

Latest posts by Maitham Al Lawati (see all)

• What Is DMARC Policy? None, Quarantine And Reject - September 15, 2024
• Fix SPF Permerror: Overcome SPF Too Many DNS Lookups Limit - April 26, 2024
• How to Publish a DMARC Record in 3 Steps? - April 2, 2024